Beers with Talos Podcast

Adversaries are experimenting with AI-integrated malware, and today's guest, Talos researcher Ryan Fetterman has been looking at their working notes. He joins us to talk about CAIRN, his new open-source research toolkit for tracking that experimentation, and what he’s finding, including a C2 an implant that delegates its decisions to AI models, and malware that tries to persuade AI analysis tools to leave it alone. Putting AI in malware is one thing. Establishing whether any of it actually works takes rather more investigation.
A special segment with Joe (from 7.07 to 25.25) talks about his newly published Human IR Framework (published in a personal capacity on Joe's GitHub), the experiences that led him to build it, and why “burnout” doesn’t adequately describe what certain people who work in cybersecurity can go through.
Meanwhile, Dave definitely prepared his "Reason not to Quit" in advance, an attempt to make Hazel Philadelphian takes an unexpected turn towards Wales, and Bill's "Make Hazel a hacker" question sends Hazel once again into a pit of self despair.

Twenty-four hours before recording this episode, Martin Lee stopped being a Talos employee. Naturally, we made him come on the podcast anyway.
Martin talks about abandoning his early career aspirations of researching human viruses and curing cancer, so he could play on the internet. He also talks about how running very long distances in crazy conditions helps him to stop himself thinking about it. 
He has some words of wisdom for aspiring practitioners, and why the rest of us should occasionally close our laptops and venture outside...dangerous business, we reckon.
Plus: Does saying please and thank you improve an AI’s answers? What did Agatha Christie have against Bletchley? And how quickly can a $245 million cryptocurrency theft unravel when someone starts buying Lamborghinis at a rate of one a day?
Martin's blog on 'Securing the unpatchable' can be found here https://blog.talosintelligence.com/securing-the-unpatchable-in-an-age-of-ai-driven-vulnerabilities/

What does it take to become someone a cybercriminal will trust? 
Talos' Azim Khodjibaev takes us inside the psychology of direct adversary engagement. At one point, he was maintaining eight different personas, some of which were talking to each other. He explains how discipline and patience help keep his cover intact, and what can provoke threat actors into revealing information. 
His work has occasionally made Azim part of the story. Ransomware operators have threatened him, and one even put “Azim sucks” in their code. He shares how his research has contributed to Talos identifying prolific cybercriminals and disrupting ransomware operations (experiences that will feature in the forthcoming book "Owned").
The conversation also examines how cybercrime is changing. More inexperienced, loosely organized collectives can pull dozens of people into an active intrusion through a Telegram channel, and Azim tells the crew about one particular ransomware trend that's keeping him up at night.
Before all that, we tackle a listener question about what defenders should prioritise when patching everything is impossible. Hazel tries some American snacks for the first time, Joe tests Hazel's patience with more hacker training, and Dave argues that without Yaddle, there would be no Star Wars.

Kaitlin Acharya joins the Beers with Talos crew to take us inside the world of threat intelligence: what happens when Talos spots something that could become a major threat, how her team tracks changes in threat actor behavior, and how intelligence moves from an investigation into detection content. She also faces some tougher questions involving tennis, Derry Girls and an evil genie.
We also attempt to extract some information about Kaitlin’s former life at a certain intelligence agency. Results are limited.
Our listener question asks which high school subject produces the best cybersecurity professionals. We get to that after arguing over whether it’s “math” or “maths” (it’s maths). 
In Make Hazel a Hacker, Dave puts Hazel in charge of the security budget for a manufacturer of AI-enabled smart toilets. Bill’s Reason Not to Quit looks back at the people and community that make Hacker Summer Camp worth surviving, before Joe’s Corner picks up that thread with a reminder of just how much the cybersecurity community can change someone’s career.

Cybercriminals are increasingly relying on AI, but in doing so, they're creating an entirely new source of threat intelligence.
This week, Talos researcher Arnaud Zobec joins Hazel, Bill, Joe and Dave to discuss what happens when attackers leave behind AI prompt logs, agent configurations and other unexpected artifacts. From jailbreak attempts to agentic workflows and accidental infrastructure leaks, the team discusses what these artifacts reveal about attacker behavior, and where/how AI is changing offensive operations and campaigns. Here's the link to that blog https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/
Also in this episode: our listener question tackles the surprising bad actor developments in over the past year, plus a bonus question on walk-on songs officially makes us a music podcast. Bill puts Hazel through her paces with an old school SOC question in 'Make Hazel a hacker'. And Dave leaves everyone with chills.